A New Era for Borrower Protection
The RBI has consolidated multiple existing instructions into a single, robust framework designed to protect borrowers and bring accountability to the loan recovery process. Effective January 1, 2027, these guidelines apply to all commercial banks and non-banking
financial companies (NBFCs), fundamentally changing how lenders can pursue unpaid dues. The rules were announced on August 6, 2026, giving financial institutions time to update their policies, train staff, and implement the necessary systems for compliance. The core objective is to ensure the fair treatment of borrowers, recognising that while lenders have a right to recover money, it cannot be at the cost of a person's dignity and privacy.
What Is Strictly Prohibited?
The new guidelines explicitly outlaw many of the aggressive tactics that have led to widespread complaints. Recovery agents are now forbidden from using threatening or abusive language, making intimidating phone calls, or publicly shaming borrowers by posting their personal details on social media. The practice of contacting a borrower's friends, relatives, or colleagues to apply pressure is also banned. Furthermore, the era of anonymous, persistent calls is over. Banks must inform borrowers in advance which recovery agency and specific agent has been assigned to their case and maintain a public list of their empanelled agencies. All recovery-related calls must now be recorded and preserved for at least six months, providing a clear record in case of disputes.
Setting Clear Boundaries on Contact
One of the most significant changes is the establishment of a strict daily window for communication. Recovery agents can only contact borrowers—whether by phone or in person—between 8 a.m. and 7 p.m. Any contact outside these hours is considered harassment, unless the borrower has specifically requested it. Surprise visits are also a thing of the past. An agent must inform a borrower of a planned visit at least one day in advance, which should ideally take place at a location of the borrower's choosing. The rules also mandate sensitivity during exceptional circumstances, cautioning agents against visits during events like festivals or bereavements.
The Rules on Tech-Based Recovery
The RBI has also addressed the growing trend of using technology to force repayment. The new framework prohibits lenders from remotely locking or disabling a borrower's personal devices, like a mobile phone or laptop, to recover a loan that is unrelated to the device itself. An exception is made only when the loan was taken specifically to finance that device. Even in such cases, lenders must follow a gradual process. Restrictions cannot begin until the loan is at least 30 days past due, and full restrictions can only be imposed after 60 days. Critically, essential functions like incoming calls, SMS, and emergency services must remain active. Banks are also forbidden from accessing a borrower's personal data, including contacts, photos, or location history, for recovery purposes.
Accountability and Redressal for Borrowers
Under the new rules, banks are directly accountable for the conduct of their recovery agents. They are required to adopt a board-approved recovery policy, conduct due diligence on the agencies they hire, and ensure all agents are properly trained and certified by the Indian Institute of Banking and Finance (IIBF). For borrowers, this means a clearer path to justice. Every bank must establish a dedicated grievance redressal mechanism specifically for complaints related to recovery practices. If a lender violates the rules—for instance, by failing to restore a remotely locked device within an hour of payment—the borrower may be entitled to compensation.
